lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <b7300fbb-41b5-4a30-b086-a8dde8ede207@nvidia.com> Date: Tue, 28 Nov 2023 14:53:33 +0200 From: Tariq Toukan <tariqt@...dia.com> To: Dinghao Liu <dinghao.liu@....edu.cn> Cc: Saeed Mahameed <saeedm@...dia.com>, Leon Romanovsky <leon@...nel.org>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Rahul Rameshbabu <rrameshbabu@...dia.com>, Zhengchao Shao <shaozhengchao@...wei.com>, Simon Horman <horms@...nel.org>, Aya Levin <ayal@...dia.com>, netdev@...r.kernel.org, linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH] [v2] net/mlx5e: fix a potential double-free in fs_any_create_groups On 28/11/2023 11:29, Dinghao Liu wrote: > When kcalloc() for ft->g succeeds but kvzalloc() for in fails, > fs_any_create_groups() will free ft->g. However, its caller > fs_any_create_table() will free ft->g again through calling > mlx5e_destroy_flow_table(), which will lead to a double-free. > Fix this by setting ft->g to NULL in fs_any_create_groups(). > > Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API") > Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn> > --- > > Changelog: > > v2: Setting ft->g to NULL instead of removing the kfree(). > --- > drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c > index be83ad9db82a..6207ffe74233 100644 > --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c > @@ -435,6 +435,7 @@ static int fs_any_create_groups(struct mlx5e_flow_table *ft) > in = kvzalloc(inlen, GFP_KERNEL); > if (!in || !ft->g) { > kfree(ft->g); > + ft->g = NULL; > kvfree(in); > return -ENOMEM; > } Reviewed-by: Tariq Toukan <tariqt@...dia.com>
Powered by blists - more mailing lists